fix(skill): technical review — defensive mode, severity model, cross-field validation, fact corrections

.gitignore

@@ -5,6 +5,11 @@ dist/
 .DS_Store
 .env
 .env.*
+__pycache__/
 
 # Internal working docs — never published
 docs/
+/.atl
+
+# RFSAM Skill — audit artifacts and secrets, never committed
+Skill/loot/

Skill/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "RFSAM — RF Security Audit"
+  short_description: "Radio frequency security audit with the RFSAM methodology"
+  default_prompt: "Audit this RF target following RFSAM: identify the protocol, walk through the 7-layer descent (IG→SP→PHY→LL→CR→AT→AP) and register findings with evidence."

Skill/assets/executive-summary-template.md

@@ -0,0 +1,123 @@
+# Executive Summary — Radio Frequency Security Audit · {{TARGET}}
+
+> Template for the **executive summary** of an RFSAM audit, aimed at sponsors and
+> non-technical committees. **No commands, no CVSS vectors, no control IDs.** The agent
+> translates findings from the technical report (`assets/report-template.md`) into
+> business risk, impact and remediation priorities. Replace the `{{...}}` placeholders
+> with clear, concrete language. Target length: **1–2 pages**. If it exceeds that, trim
+> detail and move it to an appendix in the technical report.
+
+**Delivery date**: {{ISO}}
+**Prepared for**: {{name/title of sponsor or committee}}
+**Prepared by**: {{name/role of auditor}}
+**Classification**: {{Confidential / Internal / Public}}
+**Associated technical report**: `{{path to rfsam-report-<target>.md}}`
+
+---
+
+## 1. Context in one sentence
+
+{{One or two sentences: what radio frequency system or environment was assessed, why
+it matters to the business and under what engagement it was performed. E.g.: "The
+wireless exposure of manufacturing plant X was reviewed to confirm that control
+communications and mobile devices do not allow unauthorized access."}}
+
+## 2. Main conclusion
+
+{{Executive verdict in 2–3 lines: overall risk level and the single takeaway the reader
+should come away with. E.g.: "The environment presents **high** wireless risks
+concentrated in 3 critical findings. They are closable in under 90 days with coordinated
+actions from device vendors and the operations team."}}
+
+**Overall risk**: {{Critical / High / Medium / Low}}
+
+---
+
+## 3. Findings in figures
+
+| Risk level | Count | What it means in practice |
+|------------|-------|---------------------------|
+| **Critical** | {{c}} | Exploitable today; can compromise operations, data or physical safety |
+| **High** | {{h}} | Exploitable with effort or under specific conditions; serious impact if it occurs |
+| **Medium** | {{m}} | Requires favorable access or combinations; limited or localized impact |
+| **Low / Informational** | {{l}} | Hardening recommended; no immediate exposure |
+
+> Total confirmed findings: **{{N}}**. Additionally **{{nh}}** are documented as verifiable
+> hypotheses that require further testing in a controlled environment before being confirmed.
+
+---
+
+## 4. Risks requiring immediate attention
+
+> One block per **critical or high** finding. Maximum 5–7 items; if there are more,
+> group by theme. For each: **what happens** (without jargon), **what it affects**
+> (business/operations/compliance/security) and **how easy it is to exploit**.
+> Do not include how to exploit it or technical steps.
+
+### Risk 1 — {{short, business-oriented title}}
+- **What we observed**: {{plain-language description. E.g.: "Anyone with commercially
+  available equipment can spoof the signal from the sensors and send false readings to
+  the central system."}}
+- **Impact if it materializes**: {{operational / financial / safety /
+  regulatory / reputational. E.g.: "Automated decisions made on falsified data; possible
+  line stoppage and quality rejections."}}
+- **Likelihood of occurrence**: {{High / Medium / Low}} — {{brief reason:
+  publicly available tools / requires physical proximity / requires specialized
+  knowledge}}.
+- **Remediation priority**: {{Immediate / 30 days / 90 days}}.
+
+{{... more risks in priority order ...}}
+
+---
+
+## 5. What is working well
+
+{{2–4 short bullets about controls, layers or practices that do work and that the audit
+confirmed as robust. This balances the message and indicates where NOT to intervene.
+E.g.: "Corporate Wi-Fi network encryption uses current standards and showed no weaknesses;
+LoRa devices use unique keys per node and are not clonable."}}
+
+---
+
+## 6. Recommended action plan
+
+| Priority | Risk to close | Main action (no technical detail) | Suggested owner | Estimated effort | Deadline |
+|----------|---------------|-----------------------------------|-----------------|------------------|----------|
+| 1 | {{Risk 1}} | {{business action, e.g.: "Coordinate with the sensor vendor to change the authentication mechanism."}} | {{Operations / IT / Vendor}} | {{Low/Medium/High}} | {{immediate / 30d / 90d}} |
+| 2 | {{Risk 2}} | {{...}} | {{...}} | {{...}} | {{...}} |
+| 3 | {{...}} | {{...}} | {{...}} | {{...}} | {{...}} |
+
+> **Critical and high** findings require coordinated action at three levels: the device/
+> firmware **manufacturer**, the **integrator** who deploys and configures, and the
+> **operator** who monitors and responds. **Low or informational** findings may be closed
+> with operator actions alone.
+
+---
+
+## 7. Scope and confidence
+
+- **What we covered**: {{protocols and devices assessed, mode of operation:
+  passive listening only / authorized active testing / lab environment}}.
+- **What we did NOT cover**: {{out-of-scope protocols or devices; time windows or bands
+  not observed; devices that were not operational during the audit}}.
+- **Confidence**: **confirmed** findings are backed by reproducible evidence. Those marked
+  as **hypotheses** require additional verification before being treated as confirmed.
+- **Applicable compliance**: {{if applicable, mention relevant frameworks — ISO 27001,
+  IEC 62443, PCI-DSS, local spectrum regulation — and whether the audit provides evidence
+  for or against}}.
+
+---
+
+## 8. Suggested next steps
+
+1. **Validate priorities** with the technical and business teams (1-hour meeting).
+2. **Begin closure** of critical findings within the agreed window.
+3. **Re-audit** after applying remediation to confirm effective closure.
+4. **Establish a cadence** for wireless surface review (semi-annually or upon relevant
+   changes to the device fleet).
+
+---
+
+_Executive summary generated following RFSAM (CC BY-SA 4.0). Full technical detail,
+commands, evidence and control mapping are in the associated technical report. For
+technical questions, contact the auditor; for business decisions, the sponsor._

Skill/assets/finding-template.md

@@ -0,0 +1,110 @@
+# RF Finding Template — {{RF-NNN}}
+
+> **Standalone document per finding.** Use it for `critical`/`high` that deserve a
+> detailed write-up beyond the report section (see `assets/report-template.md §4`).
+> The compact chat block lives in `references/03-finding-registration.md §3`; the
+> complete 4-axis model (decision table, worked examples) is in `§7` of the same
+> file.
+
+**ID**: {{RF-NNN}}
+**Title**: {{specific finding title}}
+**Protocol/Layer**: {{BLE / AT}} · **RFSAM control**: `{{RFSAM-BLE-AT-01}}`
+**Severity**: {{CRITICAL / HIGH / MEDIUM / LOW / INFO}} · **Status**: {{confirmed / hypothesis}}
+**Date**: {{ISO}}
+
+---
+
+## RFSAM 4-axis model
+
+> Walk through the axes in order (Impact sets the ceiling; the others modulate it).
+> Decision table: `references/03-finding-registration.md §7.2`.
+
+| Axis | Value | Justification (1 line) |
+|------|-------|------------------------|
+| **Impact** (1–4) | {{4}} | {{takeover / key recovered / plaintext data / DoS / observational}} |
+| **Exploitability** (1–4) | {{2}} | {{required hardware + friction to reproduce}} |
+| **Exposure** (1–4) | {{2}} | {{single device / single network / public infrastructure}} |
+| **Scope** (A/B/C/D) | {{A}} | {{achieved in the field / demonstrated in a cage (B) / hypothetical (C) / defensive (D)}} |
+
+**CVSS 4.0**: `{{CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N}}` ({{score}}, {{sev}})
+
+---
+
+## Description
+
+{{What was found, the technical mechanism and why it matters. Name the device/scenario,
+the protocol and the descent layer where it was detected. Cite the underlying vulnerability
+(CVE / weakened spec / misconfiguration) with a verifiable source. A non-trivial claim
+without a source is flagged (see `references/03-finding-registration.md §6`).}}
+
+---
+
+## Impact
+
+{{What a real attacker gains in the field: takeover, credential theft, replay, DoS,
+identity tracking. Connect to the Impact axis above. If Scope is B/C/D, clarify what
+was demonstrated vs what remains hypothetical — the severity reflects what you ACHIEVED,
+not what could theoretically be achieved.}}
+
+---
+
+## Evidence
+
+```
+COMMAND: {{exact tool + flags — verbatim}}
+OUTPUT:  {{excerpt that confirms the finding — AA, recovered key, 200 OK, decoded frame, ...}}
+```
+
+> Raw capture in `loot/captures/{{PROTO}}-{{phase}}-{{NN}}-{{timestamp}}.{{ext}}`.
+> The minimum evidence depends on severity — see `SKILL.md §REPRODUCIBLE EVIDENCE`.
+
+---
+
+## Safe reproduction
+
+> Each `poc/{{RF-NNN}}/` includes a `repro.txt`. **Without `repro.txt`, the finding is a
+> hypothesis, not a confirmed finding** — it does not enter the report as confirmed.
+
+```
+TARGET:     {{exact device/scenario}}
+HARDWARE:   {{SDR / sniffer + version}}
+SOFTWARE:   {{tool + version · OS}}
+COMMAND:    {{verbatim — flags, parameters, frequency, sample rate, gain, channel}}
+CONDITIONS: {{proximity · mode (observational/active/lab) · containment if applicable}}
+RESULT:     {{expected observable output that confirms}}
+```
+
+> ⚠ **Safety markers**: if the command involves transmission (`⚠TX`), re-confirm
+> authorization in `loot/scope.txt` before executing (see the gate in `SKILL.md`). If it
+> is passive RX, verify the tool's RX marker (`references/25-troubleshooting.md §1`).
+> Critical infrastructure (GNSS / ADS-B / rogue cell) requires containment
+> (cage/conductive enclosure) even in active mode.
+
+---
+
+## Mitigation (3 layers)
+
+> RFSAM remediation model — inherited from the 50 controls. `critical`/`high` require all 3
+> layers; `low`/`info` may close with Operator alone. `medium` requires at least Integrator + Operator. See `references/03-finding-registration.md §7`.
+
+- **Developer** (manufacturer / firmware): {{product code or configuration changes —
+  e.g. enforce ECDH, rotate NWK key, encrypt GATT, implement robust rolling code}}
+- **Integrator** (deployment / configuration): {{deployment changes — e.g. rekey after
+  commissioning, disable legacy pairing, segment PAN, require LESC}}
+- **Operator** (use / monitoring): {{operational changes — e.g. monitor anomalous
+  advertising, rotate credentials periodically, periodic audits, register only
+  authorized tags}}
+
+---
+
+## References
+
+- {{CVE-XXXX-XXXX — https://...}}
+- {{Paper: Author, "Title", venue year — https://...}}
+- {{Tool: name — https://github.com/...}}
+- {{Spec: Bluetooth Core Spec v5.4, Vol 6 Part B}}
+
+---
+
+_Generated with RFSAM (CC BY-SA 4.0). Reproducible evidence in `loot/`. Re-validate after
+applying remediation._